Stephanie Baskill, an unemployed accounting clerk, lives one block from Cleaver Manufacturing Company. While walking her dog last year, she noticed some ERP manuals in the dumpsters. Curious, she took the manuals home with her. She found that the documentation in the manual was dated 2 months previous, so she thought that the information must be fairly current. Over the next month, Stephanie continued to collect all types of manuals from the dumpster during her dog-walking excursions. Cleaver Manufacturing Company was apparently updating all of its documentation manuals and placing them online. Eventually, Stephanie found manuals about critical inventory reorder formulas, the billing system, the sales order system, the payables system, and the operating system. Stephanie wait to the local library and read as much as she could about this particular operating system.

To gain access to the organization, she took a low- profile position as a cleaning woman, giving her access to all areas in the building. While working, Stephanie snooped through offices, watched people who were working late type in their passwords, and guessed passwords. She ultimately printed out lists of user IDs and passwords using a Trojan horse virus, thus obtaining all the necessary passwords to set herself up as a supplier, customer, systems operator, and systems librarian.

As a customer, she ordered enough goods to trigger the automatic inventory procurement system to purchase more raw materials. Then, as a supplier, Stephanie would deliver the goods at the specified price. She then adjusted the transaction logs once the bills were paid to cover her tracks. Stephanie was able to embezzle, on average, $125,000 a month. About 16 months after she began working at Cleaver, the controller saw her at a very expensive French restaurant one evening, driving a Jaguar. He told the internal auditors to keep a close watch on her, and they were able to catch her in the act.

Required

a. What weaknesses in the organization’s control structure must have existed to permit this type of embezzlement?

b. What specific control techniques and procedures could have helped prevent or detect this fraud?